rb fine tune

apps/admin/src/lib/auth/context.ts

@@ -30,29 +30,72 @@ export async function getAuthContext(): Promise<AuthContext> {
     throw new Error("Unauthorized: No authenticated user");
   }
 
-  // Get role from Clerk metadata
-  const role = (sessionClaims?.metadata as { role?: UserRole })?.role;
+  // Try to get role from Clerk metadata (could be in publicMetadata or metadata)
+  let role = (sessionClaims?.publicMetadata as { role?: UserRole })?.role;
 
+  // Fallback: Try the metadata field if publicMetadata doesn't have it
+  if (!role) {
+    role = (sessionClaims?.metadata as { role?: UserRole })?.role;
+  }
+
+  // If still no role, try database lookup as last resort
   if (!role || !USER_ROLES.includes(role)) {
-    throw new Error(`Forbidden: Invalid or missing role - ${role}`);
+    console.log("Role not found in session claims, fetching from database", {
+      userId,
+      roleFromPublicMetadata: (
+        sessionClaims?.publicMetadata as { role?: UserRole }
+      )?.role,
+      roleFromMetadata: (sessionClaims?.metadata as { role?: UserRole })?.role,
+    });
+
+    try {
+      const db = await getDatabase();
+      const user = await db.getUserById(userId);
+
+      if (!user) {
+        console.error("User not found in database", { userId });
+        throw new Error(`Forbidden: User not found in database - ${userId}`);
+      }
+
+      if (user.role && USER_ROLES.includes(user.role as UserRole)) {
+        console.log("Role found in database", { userId, role: user.role });
+        role = user.role as UserRole;
+      } else {
+        console.error("Invalid role in database", { userId, role: user.role });
+        throw new Error(`Forbidden: Invalid role in database - ${user.role}`);
+      }
+    } catch (error) {
+      console.error("Failed to get role from database:", error);
+      throw new Error(
+        `Forbidden: Could not determine user role - ${error instanceof Error ? error.message : String(error)}`,
+      );
+    }
   }
 
   // Get gymId from Clerk metadata or database
   let gymId: string | null = null;
 
-  // First try Clerk metadata (faster path)
-  const clerkGymId = (sessionClaims?.metadata as { gymId?: string })?.gymId;
+  // First try Clerk publicMetadata (faster path)
+  const clerkGymId = (sessionClaims?.publicMetadata as { gymId?: string })
+    ?.gymId;
   if (clerkGymId) {
     gymId = clerkGymId;
   } else {
-    // Fallback to database lookup
-    try {
-      const db = await getDatabase();
-      const user = await db.getUserById(userId);
-      gymId = user?.gymId ?? null;
-    } catch (error) {
-      console.error("Failed to get gymId from database:", error);
-      gymId = null;
+    // Try metadata field
+    const metadataGymId = (sessionClaims?.metadata as { gymId?: string })
+      ?.gymId;
+    if (metadataGymId) {
+      gymId = metadataGymId;
+    } else {
+      // Fallback to database lookup
+      try {
+        const db = await getDatabase();
+        const user = await db.getUserById(userId);
+        gymId = user?.gymId ?? null;
+      } catch (error) {
+        console.error("Failed to get gymId from database:", error);
+        gymId = null;
+      }
     }
   }